CVE-2026-46197

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: validate SVM ioctl nattr against buffer size Validate nattr field against the buffer size, preventing out-of-bounds buffer access via user-controlled attribute count. cherry picked from commit...

EUVD-2026-32778

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix heap leak in IEEE 1284 device ID via short response usblpctrlmsg collapses the usbcontrolmsg return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GETDEVICE...

EUVD-2026-32750

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the shariff shortcode in all versions up to, and including, 4.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-6427

The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due to a regex bug in the filtervideos method that breaks HTML attribute quoting when processing crafted elements, combined with unescaped output in the...

CVE-2026-7048 Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

com.charlyghislain.keycloak:keycloak-importexport (23.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.13) +26 more potentially affected by CVE-2026-9794 via org.keycloak:keycloak-services (23.0.3)

org.keycloak:keycloak-services MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 23.0.1 -...

com.charlyghislain.keycloak:keycloak-importexport (23.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.13) +62 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (23.0.3)

org.keycloak:keycloak-server-spi-private MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 23.0.1 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.8.3-20.0.5, <=0.10.0-20.0.5), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=0.8.3-20.0.5, <=0.10.0-20.0.5) +55 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (20.0.5)

org.keycloak:keycloak-server-spi-private MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.8.3-20.0.5,...

fr.cnieg.keycloak:attribute-login-provider (1.3.4), io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27) +25 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (21.0.2)

org.keycloak:keycloak-services MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.4 - io.phasetwo.keycloak:keycloak-orgs =0.24, =2.5,...

CVE-2026-9009 Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

CVE-2026-9009

CVE-2026-9009 affects the Crawlomatic Multipage Scraper Post Generator plugin for WordPress (versions up to 2.7.2). The root cause is insecure handling of the attacker-supplied shortcode attributes callback_raw and callback, which are passed directly into call_user_func() after only an is_callabl...

CVE-2026-9009 Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

SUSE CVE-2026-45925

In the Linux kernel, the following vulnerability has been resolved: thermal/of: Fix reference leak in thermalofcmlookup In thermalofcmlookup, trnp is obtained via ofparsephandle, but never released. Use the freedevicenode cleanup attribute to automatically release the node and fix the leak. rjw:...

SUSE CVE-2026-46030

In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fix devicenode leak in mcprobe ofparsephandle returns a devicenode reference that must be released with ofnodeput. The original code never freed r5corenode on any exit path, causing a memory leak. Fix this by usin...

SUSE CVE-2026-46072

In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to rununpack rununpack checks runbuf runlast at the top of the while loop but then reads sizesize and offsetsize bytes via rununpacks64 without verifying they fit within the remaining buffer. A...

ALSA-2026:21557 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: j1939: j1939sessionnew: fix skb reference counting CVE-2024-56645 kernel: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr CVE-2025-68183 kernel: mm: thp: deny...

AlmaLinux 8 : kernel (ALSA-2026:21706)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21706 advisory. kernel: Bluetooth: MGMT: Fix possible UAFs CVE-2025-39981 kernel: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr CVE-2025-68183...

RHEL 9 : kernel (RHSA-2026:21556)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21556 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: proc: use the same treatment ...

Linux Distros Unpatched Vulnerability : CVE-2026-44896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...